Free SSL by platform: what builders, hosts and Cloudflare include

The short version

• Wix, Squarespace, Shopify, WordPress.com, Webflow and GoDaddy’s website builder all add a free SSL certificate on their own. You do not buy or install anything.
• The catch on builders: your domain has to point at them, and on Wix and Webflow you need a paid plan to connect a domain at all.
• All 10 web hosts we cover include free SSL, and most say it renews on its own. The real difference is wildcard support, for sites with many subdomains.
• If you put Cloudflare in front of your site, choose the Full (strict) setting. Flexible is the one that causes “too many redirects” loops.

SSL is what puts your site on https:// instead of http://, the encrypted version of the web (see HTTPS and TLS). Without it, browsers label your site “Not secure.”

Website builders: automatic, with a few conditions

On a builder, the certificate is part of the plan. Each company’s help center says it is issued and renewed for you.

DNS is the address book that tells browsers where your domain lives. A CAA record is an optional DNS entry that lists which certificate companies may issue certificates for your domain. If you have none, any company may.

If the padlock is missing on a builder site

1. Open your builder’s domain settings and confirm the domain shows as connected. If it does not, copy the DNS records the builder gives you into your registrar’s DNS settings.
2. Wait out the window in the table above.
3. Look at your DNS for CAA records. If one names only a different certificate company, remove it or ask the builder’s support which company to allow.
4. Still stuck after the waiting time? Contact the builder’s support. They issue the certificate, so they can see why it failed.

More fixes are in our guide to fixing SSL errors.

The 10 web hosts in one table

If you run WordPress or another app on web hosting, the free certificate usually comes from Let’s Encrypt or a similar company and renews in the background. What the hosts’ own pages say, as of October 2026:

• A wildcard certificate covers every subdomain one level down, so *.example.com covers shop.example.com but not example.com itself. Most small sites never need one. Our guide to certificate types explains when you would.
• GoDaddy’s Economy plan includes free SSL for 1 year. What it costs after that is not published on the plan page.
• Kinsta’s certificates keep renewing only if the _acme-challenge CNAME record stays in your DNS. Do not delete it during a cleanup.
• WP Engine’s support page says its Lite and Startup plans cannot import a third-party certificate.

Turn on SSL at a host

1. Point your domain at the host, using the name servers or A record the host gives you.
2. Open the SSL or security section of your hosting control panel. On most hosts the free certificate is already on. On Bluehost, activate it yourself.
3. Visit your site with https:// in front.
4. Turn on the host’s HTTP-to-HTTPS redirect, if it has one, so every visitor lands on the secure version. In WordPress, also change WordPress Address (URL) and Site Address (URL) under Settings, General to start with https://.
5. Check a few pages for mixed content (images or scripts still loading over http://). Our SSL fixes guide covers this.

Cloudflare in front: Flexible vs Full (strict)

Cloudflare is a service that sits between visitors and your host, a kind of CDN. Its free Universal SSL works on the Free, Pro, Business and Enterprise plans. It covers your root domain and first-level subdomains such as www.example.com, lasts 90 days and starts renewing 30 days before expiry.

With Cloudflare there are two connections: visitor to Cloudflare, and Cloudflare to your server. The encryption mode decides what happens on the second one. Cloudflare’s docs list these modes:

• Automatic SSL/TLS: the default. Cloudflare picks the most secure mode your server supports.
• Off: no encryption.
• Flexible: visitors get HTTPS, but Cloudflare talks to your server over plain HTTP.
• Full: HTTPS to your server for HTTPS visitors, but Cloudflare does not check your server’s certificate.
• Full (strict): like Full, but Cloudflare checks that your server’s certificate is valid.
• Strict (SSL-Only Origin Pull): always HTTPS to your server, with the certificate checked.

Flexible is the common trap. If your host already sends all HTTP traffic to HTTPS, Flexible creates a loop, and your browser shows ERR_TOO_MANY_REDIRECTS.

Set Cloudflare up the safe way

1. Make sure your server has a valid certificate. The host’s free one from the table works. You can also use a Cloudflare Origin CA certificate, which encrypts only the link between Cloudflare and your server and works with Full (strict).
2. In the Cloudflare dashboard, go to the SSL/TLS Overview page for your domain and choose Full (strict) as the encryption mode.
3. Open your site in a private browser window. If it loads with the padlock and no redirect error, you are done.

Cloudflare is also a registrar. See our Cloudflare registrar page if you keep your domain there.

Do you ever need to buy a certificate on these platforms?

Rarely. Squarespace and Shopify do not accept outside certificates at all, and Webflow allows one only on Enterprise. On hosts, you would buy one for a wildcard where the free SSL has none (WP Engine, DreamHost, Hostinger’s Web and Cloud plans), or if you want a company-verified OV or EV certificate. Our free vs paid SSL guide compares prices.

Automatic renewal matters more each year. As of October 2026, certificates issued from March 15, 2026 can last at most 200 days. That drops to 100 days from March 15, 2027 and 47 days from March 15, 2029. A certificate you upload by hand has to be replaced that often, and Webflow says uploaded certificates are not auto-renewed. Start at our SSL certificates hub for the basics, or see when to hire help.

Sources: Wix SSL help, Wix SSL troubleshooting, Squarespace SSL help, Shopify secure connections, WordPress.com HTTPS, Webflow SSL hosting, Webflow pricing, GoDaddy builder SSL help, Bluehost shared hosting, Bluehost SSL help, Bluehost SSL pricing, Cloudways Let’s Encrypt, DreamHost SSL overview, DreamHost pricing, GoDaddy web hosting, Hosting.com SSL, Hosting.com plans, Hostinger SSL, Hostinger wildcard support, InMotion shared hosting, InMotion AutoSSL, InMotion wildcard Q&A, Kinsta SSL FAQ, SiteGround hosting, SiteGround SSL types, WP Engine SSL, Cloudflare Universal SSL, Cloudflare validity periods, Cloudflare encryption modes, Cloudflare redirect loops, Cloudflare Origin CA, RFC 8659 (CAA), CA/Browser Forum Baseline Requirements.